siglent-sdg-mcp 2.0.4 → 2.0.6

package/README.md

@@ -379,7 +379,7 @@ What the server enforces, regardless of what the model was told:
 |-----------|------------------|
 | **Command-boundary check** on every string written to the socket: no control characters (incl. newlines), no `;`, ASCII only, max 512 chars | Smuggling extra SCPI commands through any parameter (`load: "50\nC1:OUTP ON"`) |
 | **Strict parameter formats** for the free-text parameters (`load`, `cycles`, arbitrary waveform `name`) | Breaking out of a parameter or a quoted string |
-| **`scpi_query` is query-only**: a single header ending in `?`; parameters after `?` only for queries documented to take them (`STL?`, `MMEMory:CATalog?`), and only in their documented forms; common commands only as pure queries (`*IDN?`, `*OPC?`, ...) | Using the "read-only" tool to change state (`scpi_query("C1:OUTP ON")`, `"C1:BSWV? AMP,10"`, `"*RST?"`) |
+| **`scpi_query` is query-only**: a single header ending in `?`; parameters after `?` only for queries documented to take them (`STL?`, `MMEMory:CATalog?`), and only in their documented forms; common commands only as pure queries (`*IDN?`, `*OPC?`, ...); action commands the programming guide documents without a query form are rejected in `?` form | Using the "read-only" tool to change state (`scpi_query("C1:OUTP ON")`, `"C1:BSWV? AMP,10"`, `"*RST?"`, `"C1:TRIGger?"`) |
 | **Raw `scpi_command` is off by default**, and can only be enabled together with named instrument hosts (`*` is not accepted) | An unrestricted command channel to the instrument, or to other SCPI devices on the LAN (power supplies often use port 5025 too) |
 | **Connect allowlist**: `connect` only reaches `SIGLENT_SDG_IP`, `SIGLENT_ALLOWED_HOSTS`, or (if neither is set) private-LAN IP addresses, and only the instrument port | Using the server as a TCP client to reach other services, e.g. `169.254.169.254` |
 **What it does not protect against:**

package/build/security/scpi-guard.js

@@ -41,13 +41,14 @@ export function assertWireSafe(cmd) {
 }
 /**
  * Query shape: an optional root colon or '*', a header, then '?' immediately
- * after it, optionally followed by parameters.
+ * after it, optionally followed by parameters. Every node of the header is
+ * non-empty: "C1::TRIG?" and "C1:TRIG:?" are not queries.
  *
  * This is a structural check (allowlist of shape), not a denylist of setter
  * keywords, so long-form headers or unusual setters cannot slip through:
  * anything without '?' directly after the header is not a query.
  */
-const QUERY_PATTERN = /^(\*|:)?([A-Za-z][A-Za-z0-9_:]*)\?(?: ([A-Za-z0-9_,.+\-"/ ]*))?$/;
+const QUERY_PATTERN = /^(\*|:)?([A-Za-z][A-Za-z0-9_]*(?::[A-Za-z][A-Za-z0-9_]*)*)\?(?: ([A-Za-z0-9_,.+\-"/ ]*))?$/;
 /**
  * Queries that legitimately take parameters after the '?', each with the
  * exact parameter shapes the SDG programming guide documents. For any other
@@ -80,6 +81,69 @@ const QUERY_PARAMETER_RULES = [
  * marked read-only must not do.
  */
 const COMMON_QUERIES = new Set(["IDN", "OPC", "STB", "ESE", "SRE", "OPT"]);
+/**
+ * A SCPI mnemonic as a regex source: the short form (the upper-case part)
+ * followed by any leading part of the rest, so "MTRigger" matches MTR, MTRI,
+ * ... MTRIGGER. SCPI only defines the short and long forms; accepting the
+ * lengths in between is deliberate, because this list blocks, and blocking a
+ * spelling the firmware might also accept is the safe direction.
+ */
+function mnemonic(m) {
+    const short = /^[A-Z0-9]+/.exec(m)?.[0] ?? "";
+    const tail = m.slice(short.length).toUpperCase();
+    return short + [...tail].reduceRight((rest, ch) => `(?:${ch}${rest})?`, "");
+}
+/**
+ * A header pattern written in the programming guide's notation: "<ch>:" a
+ * channel prefix (C1:, C2:), "A|B" alternatives and "[:NODE]" an optional
+ * node. Blocking more spellings than the guide documents is the safe
+ * direction, so every pattern also matches a channel prefix where the guide
+ * has none ("C1:MMEM:DEL") and a numeric suffix on any node ("SENS1",
+ * "SEGMent3"), which SCPI parsers commonly accept.
+ */
+function headerPattern(spec) {
+    const rest = spec.startsWith("<ch>:") ? spec.slice("<ch>:".length) : spec;
+    let source = "(?:C\\d+:)?";
+    const nodes = rest.match(/\[:[^\]]+\]|[^:[\]]+/g) ?? [];
+    nodes.forEach((node, i) => {
+        const optional = node.startsWith("[");
+        const body = optional ? node.slice(2, -1) : node;
+        const pattern = `(?:${body.split("|").map(mnemonic).join("|")})\\d*`;
+        source += optional ? `(?::${pattern})?` : `${i === 0 ? "" : ":"}${pattern}`;
+    });
+    return new RegExp(`^${source}$`, "i");
+}
+/**
+ * Commands the SDG programming guide documents with no query form: actions
+ * (trigger, clear, delete, copy, save, load) and setters whose bare form
+ * creates or deletes something, plus EQPHASE: the guide lists a response
+ * format for it, but documents it only as a command that aligns the channel
+ * phases, which steps the phase of a running output. The shape check can't tell "C1:TRIGger?" from
+ * a real query, and whether the firmware ignores the '?' or runs the action
+ * isn't documented, so a tool marked read-only must not send them.
+ *
+ * Matched against the whole header, so queries that share a node with an
+ * action (C1:TRIGger:SOURce?, C1:TRIGger:TIMer?) are unaffected.
+ * Defence in depth on top of the shape check; undocumented headers remain a
+ * residual risk (see docs/threat-model.md).
+ */
+const ACTION_HEADERS = [
+    "<ch>:SWEep:MTRigger",
+    "<ch>:TRIGger[:SEQuence][:IMMediate]",
+    "<ch>:SEQuence:DEFAult|NEW|RECall|SAVe",
+    "<ch>:SEQuence:SEGMent:DELEte|INSErt",
+    "<ch>:FHOP:AFLIst|DFLIst|CFLIst|MFLIst|LFLIst|SFLIst",
+    "<ch>:FHOP:AOLIst|DOLIst|COLIst|MOLIst|LOLIst|SOLIst",
+    "<ch>:FHOP:AALIst|DALIst|CALIst|LALIst|SALIst",
+    "SENSe:COUNTer:CLEar",
+    "PACP|PARACOPY",
+    "VKEY|VIRTUALKEY",
+    "MMEMory:DELete|RDIRectory|MDIRectory|COPY|MOVE|TRANsfer",
+    "MMEMory:SAVE|LOAD:XML",
+    "EQPHASE",
+    // Switches both outputs on or off; documented in 3.3 without a query form.
+    "OUT_BOTHCH",
+].map((spec) => ({ spec, header: headerPattern(spec) }));
 export function assertIsQuery(cmd) {
     assertWireSafe(cmd);
     const m = QUERY_PATTERN.exec(cmd.trim());
@@ -93,6 +157,13 @@ export function assertIsQuery(cmd) {
         throw new ScpiPolicyError(`"*${name}?" is not allowed: only the common queries ` +
             `${[...COMMON_QUERIES].map((q) => `*${q}?`).join(", ")} are permitted.`);
     }
+    if (prefix !== "*") {
+        const action = ACTION_HEADERS.find((a) => a.header.test(header));
+        if (action) {
+            throw new ScpiPolicyError(`"${header}?" is not allowed: ${action.spec} is an action command with no documented ` +
+                "query form, and the instrument might run it.");
+        }
+    }
     if (params !== undefined && params.trim() !== "") {
         const rule = QUERY_PARAMETER_RULES.find((r) => r.header.test(header));
         if (!rule) {

package/build/server.d.ts

@@ -1,5 +1,5 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import type { ServerConfig } from "./config.js";
-export declare const SERVER_VERSION = "2.0.4";
+export declare const SERVER_VERSION = "2.0.6";
 /** Build the MCP server with all tools registered under the given configuration. */
 export declare function createServer(config: ServerConfig): McpServer;

package/build/server.js

@@ -8,7 +8,7 @@ import { registerBurstTools } from "./tools/burst.js";
 import { registerArbitraryTools } from "./tools/arbitrary.js";
 import { registerUtilityTools } from "./tools/utility.js";
 import { registerScpiTools } from "./tools/scpi.js";
-export const SERVER_VERSION = "2.0.4";
+export const SERVER_VERSION = "2.0.6";
 /** Build the MCP server with all tools registered under the given configuration. */
 export function createServer(config) {
     const server = new McpServer({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "siglent-sdg-mcp",
-  "version": "2.0.4",
+  "version": "2.0.6",
   "description": "MCP server for Siglent SDG waveform generator control via SCPI over TCP sockets",
   "type": "module",
   "main": "build/index.js",